Apache Airflow's Variable response masker has a recursion depth limit for redacting sensitive keys in JSON values. When the nesting depth of JSON exceeds this limit, the masker returns the original nested item without redacting sensitive keys such as those ending with 'password', 'token', 'secret', or 'api_key'. This allows an authenticated UI/API user with Variable read permission to retrieve plaintext secret values stored in deeply nested JSON Variables. This vulnerability is a continuation of the issue addressed in CVE-2026-32690 but affects deeper nesting levels beyond the previous fix's max_depth=1 limit. The vulnerability is fixed in Apache Airflow version 3.2.2 and later.

An authenticated user with Variable read permission can bypass sensitive data redaction for deeply nested JSON keys containing secrets, potentially exposing confidential information such as passwords, tokens, or API keys. This exposure does not affect integrity or availability but results in a confidentiality breach of sensitive configuration data.

Upgrade Apache Airflow to version 3.2.2 or later to address this vulnerability. This update raises the recursion depth limit for the Variable response masker, ensuring sensitive keys in deeply nested JSON values are properly redacted. No other mitigation is indicated by the vendor advisory.